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REMARKS 

The Office Action dated December 26, 2007, has been 
received and carefully considered. In this response, claims 1- 
3, 5, 7, 9, 12-16, 18 and 21 have been amended, and claims 22-24 
have been added. Entry of the amendments to claims 1-3, 5, 7, 
9, 12-16, 18 and 21, and the addition of claims 22-24 is 
respectfully requested. Reconsideration of the current 

rejections in the present application is respectfully requested 
based on the following remarks. 

I . THE NON- STATUTORY SUBJECT MATTER REJECTION OF CLAIM 11 

On page 2 of the Office Action, claim 11 was rejected under 
35 U.S.C. § 101 as being directed to non-statutory subject 
matter. This rejection is hereby respectfully traversed. 

The Examiner asserts that claim 11 is non-statutory 
because, on page 19, lines 7-9, of the specification, Applicant 
describes that the medium that carries the instructions can be a 
form of signal. Moreover, the Examiner requires that the 
recitation "or transmitted to one or more processors via one or 
more signals" be deleted from the specification. Applicant 
respectfully disagrees. Applicant respectfully submits that the 
specification recites "one or more processors operating in 
accordance with stored instructions may implement the functions 
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associated with source address tracing in accordance with the 

present invention as described above. If such is the case , it 

is within the scope of the present invention that such 

instructions may be stored on one or more processor readable 

carriers (e.g., a magnetic disk), or transmitted to one or more 

processors via one or more signals ." See, page 19, lines 2-9. 

Therefore, Applicant respectfully submits that the instructions 

are stored (e.g., on a magnetic disk) and may be either readable 

by one or more processors or transmitted to one or more 

processors via one or more signals. Furthermore, Applicant 

respectfully submits that claim 11 does not recite "the medium 

that carries the instructions can be a form of signal," as 

asserted by the Examiner. For example, claim 11 recites " [a] t 

least one processor readable medium for storing a computer 

program of instructions configured to be readable by at least 

one processor for instructing the at least one processor to 

execute a computer process for performing the method as recited 

in claim 1." This contradicts the Examiner's assertion that the 

claim 11 does not recite a computer program being stored and 

executable on any readable medium. Thus, claim 11 clearly 

recites such a tangible embodiment . 

In addition, the Examiner asserts that the specification 

never clearly discloses what a processor readable medium would 
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be because the processor readable medium can be either a 

processor readable carriers (e.g., a magnetic disk) or a signal 

via which instructions are transmitted to the processors. 

Applicant respectfully submits that the Examiner misinterpreted 

the disclosure of the Specification. In particular, Applicant 

recites that instructions may be stored on one or more processor 

readable carriers (e.g., a magnetic disk) or instructions may be 

transmitted to one or more processors via one or more signals 

and NOT the one or more processor readable carriers is the one 

or more signals . Therefore, nowhere does Applicant disclose 

that the one or more processor readable carriers may be one or 

more signals. 

In view of the foregoing, it is respectfully requested that 
the aforementioned non-statutory subject matter rejection of 
claim 11 be withdrawn. 

II . THE ANTICIPATION REJECTION OF CLAIMS 1-5, 9, 12-16, 20 & 21 
On pages 3-4 of the Office Action, claims 1-5, 9, 12-16, 
20, and 21 were rejected under 35 U.S.C. § 102(a) as being 
anticipated by Peng et al . ("Detecting Distributed Denial of 
Service Attacks Using Source IP Address Monitoring"). This 
rejection is hereby respectfully traversed. 
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Under 35 U.S.C. § 102, the Patent Office bears the burden 

of presenting at least a prima facie case of anticipation. In re 

Sun , 31 USPQ2d 1451, 1453 {Fed. Cir. 1993) (unpublished) . 

Anticipation requires that a prior art reference disclose, 

either expressly or under the principles of inherency, each and 

every element of the claimed invention. Id. . "In addition, the 

prior art reference must be enabling." Akzo N.V. v. U.S. 

International Trade Commission , 808 F.2d 1471, 1479, 1 USPQ2d 

1241, 1245 (Fed. Cir. 1986), cert, denied , 482 U.S. 909 (1987). 

That is, the prior art reference must sufficiently describe the 

claimed invention so as to have placed the public in possession 

of it. In re Donohue , 766 F.2d 531, 533, 226 USPQ 619, 621 (Fed. 

Cir. 1985) . Such possession is effected only if one of ordinary 

skill in the art could have combined the disclosure in the prior 

art reference with his/her own knowledge to make the claimed 

invention. Id. . 

Regarding claims 1, 12, and 21, the Examiner asserts that 
Peng et al . discloses the claimed invention. Applicant 
respectfully disagrees. However, in order to forward the 
present application toward allowance, Applicant has amended 
claims 1, 12, and 21 to more specifically define the claimed 
invention, and specifically those features that differentiate 
the claimed invention from Peng et al . , as well as the other 
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cited references. In particular, Applicant respectfully submits 

that Peng et al . fails to disclose, or even suggest, a method 

for tracing source addresses of packets, the method comprising: 

"querying a storage module of the network element to identify at 

least one source address of a previously received packet 

recorded within a predetermined time period prior to receiving 

the current packet," as presently claimed. In contrast, Peng et 

al . merely discloses comparing current counts of a hash table 

with an Address Database (IAD) to calculate how many new IP 

addresses have appeared in a time slot. Additionally, if the 

number of packets per IP address is larger than a certain 

threshold, an alarm is set to indicate a bandwidth attack. See, 

page 4, Section A. Accordingly, is it respectfully submitted 

that claims 1, 12 and 21 are allowable over Peng et al . 

Also, Applicant respectfully submits that Peng et al . and 

the other cited references, taken either alone or in 

combination, fail to disclose, or even suggest, routing the 

current packet to a network element if at least part of a source 

address of the current packet matches at least part of the at 

least one source address of the previously received packet , as 

presently claimed. In contrast, Peng et al . discloses adding 

legitimate IP addresses to an IP Address Database (IAD), 

recording IP addresses that appear in a current time interval in 
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a hash table along with a number of IP packets and a time stamp 

of the most recent IP packet for each IP address, and comparing 

the IAD to the hash table to determine the number of new IP 

addresses that have appeared in the current time interval. The 

Examiner asserts that the claim merely recites routing a packet, 

but has no limitation on where to route the packet, and 

therefore the Examiner interprets that the packet is routed when 

the packet is recorded in the hash table. Applicant 

respectfully disagrees. Applicant respectfully submits that 

Peng et al . merely discloses recording the packet in the hash 

table and not "routing the current packet to a network element," 

as presently claimed. Moreover, the source IP address 

monitoring (SIM) scheme of Peng et al . merely passively monitors 

the packets and fails to actively rout the packets. In 

addition, Applicant discloses in the Specification that "the 

network element may be a computer, a server, or a content -aware 

switch/router having one or more connections to a computer 

and/or communications network." See, e.g., page 8, lines 5-9. 

Therefore, the network element routs the packet to another 

network element (e.g., a computer and/or communications 

network). Thus, Applicant respectfully submits that Peng et al . 

fail to disclose, or even suggest, "routing the current packet 

to a network element if the at least part of a source address of 
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the current packet matches at least part of the at least one 

source address of the previously received packet," as presently 

claimed. 

In view of the foregoing, is it respectfully submitted that 
claims 1, 12, and 21 are allowable over Peng et al . 

At this point, Applicant would like to remind the Examiner 
that, as stated in MPEP § 2131, "[a] claim is anticipated only 
if each and every element as set forth in the claim is found, 
either expressly or inherently described, in a single prior art 
reference." Verdegaal Bros, v. Union Oil Co. of California , 2 
USPQ2d 1051, 1053 (Fed. Cir. 1987) . 

Regarding claims 2-5, 9, 13-16, and 20, these claims are 
dependent upon independent claims 1 and 12. Thus, since 
independent claims 1 and 12 should be allowable as discussed 
above, claims 2-5, 9, 13-16, and 2 0 should also be allowable at 
least by virtue of their dependency on independent claims 1 and 
12. Moreover, these claims recite additional features which are 
not disclosed, or even suggested, by the cited references taken 
either alone or in combination. 

Additionally, Applicant respectfully submits that the newly 
added claims 22-24 recite additional features which are not 
disclosed, or even suggested, by the cited references taken 
either alone or in combination. For example, claim 24 recites 
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"comparing the at least part of the source address of the packet 

with at least one of the plurality classes of subnet of the at 

least one source address recorded within the predetermined time 

period prior to receiving the packet," as presently claimed. 

In view of the foregoing, it is respectfully requested that 

the aforementioned anticipation rejection of claims 1-5, 9, 12- 

16, 20, and 21 be withdrawn. 

Ill . THE OBVIOUSNESS REJECTION OF CLAIMS 6 AND 17 

On page 5 of the Office Action, claims 6 and 17 were 
rejected under 35 U.S.C. § 103(a) as being unpatentable over 
Peng et al . ("Detecting Distributed Denial of Service Attacks 
Using Source IP Address Monitoring"). This rejection is hereby 
respectfully traversed. 

As stated in MPEP § 2143.03, to establish prima facie 
obviousness of a claimed invention, all the claim limitations 
must be taught or suggested by the prior art. In re Royka , 490 
F.2d 981, 180 USPQ 580 (CCPA 1974). That is, " [a] 11 words in a 
claim must be considered in judging the patentability of that 
claim against the prior art." In re Wilson , 424 F.2d 1382, 165 
USPQ 494, 496 (CCPA 1970) . If an independent claim is 

nonobvious under 35 U.S.C. 103, then any claim depending 
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therefrom is nonobvious . In re Fine , 837 F.2d 1071, 5 USPQ2d 

1596 (Fed. Cir. 1988) . 

Regarding claims 6 and 17, these claims are dependent upon 
independent claims 1 and 12. Thus, since independent claims 1 
and 12 should be allowable as discussed above, claims 6 and 17 
should also be allowable at least by virtue of their dependency 
on independent claims 1 and 12. Moreover, these claims recite 
additional features which are not disclosed, or even suggested, 
by the cited references taken either alone or in combination. 

In view of the foregoing, it is respectfully requested that 
the aforementioned obviousness rejection of claims 6 and 17 be 
withdrawn . 

IV. THE OBVIOUSNESS REJECTION OF CLAIMS 7, 8, 18, AND 19 

On page 5 of the Office Action, claims 7, 8, 18, and 19 
were rejected under 35 U.S.C. § 103(a) as being unpatentable 
over Peng et al . ("Detecting Distributed Denial of Service 
Attacks Using Source IP Address Monitoring") in view of 
Lingafelt et al . (U.S. Patent Application Publication No. 
US2002/0147925A1) . This rejection is hereby respectfully 

traversed. 

It is respectfully submitted that the aforementioned 
obviousness rejection of claims 7, 8, 18, and 19 has become moot 
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in view of the deficiencies of the primary reference (i.e., Peng 

et al.) as discussed above with respect to independent claims 1 

and 12. That is, claims 7, 8, 18, and 19 are dependent upon 

independent claims 1 and 12 and thus inherently incorporate all 

of the limitations of independent claims 1 and 12. Also, the 

secondary reference (i.e., Lingafelt et al . ) fails to disclose, 

or even suggest, the deficiencies of the primary reference as 

discussed above with respect to independent claims 1 and 12. 

Indeed, the Examiner does not even assert such. Thus, the 

combination of the secondary reference with the primary 

reference also fails to disclose, or even suggest, the 

deficiencies of the primary reference as discussed above with 

respect to independent claims 1 and 12. Accordingly, claims 7, 

8, 18, and 19 should be allowable over the combination of the 

secondary reference with the primary reference at least by 

virtue of their dependency on independent claims 1 and 12. 

Moreover, claims 7, 8, 18, and 19 recite additional features 

which are not disclosed, or even suggested, by the cited 

references taken either alone or in combination. 

In view of the foregoing, it is respectfully requested that 

the aforementioned obviousness rejection of claims 7, 8, 18, and 

19 be withdrawn. 
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V. THE OBVIOUSNESS REJECTION OF CLAIM 11 

On page 6 of the Office Action, claim 11 was rejected under 

35 U.S.C. § 103(a) as being unpatentable over Peng et al . 

("Detecting Distributed Denial of Service Attacks Using Source 

IP Address Monitoring") in view of Langberg et al . (U.S. Patent 

No. 5,852,630). This rejection is hereby respectfully 

traversed. 

It is respectfully submitted that the aforementioned 
obviousness rejection of claim 11 has become moot in view of the 
deficiencies of the primary reference (i.e., Peng et al . ) as 
discussed above with respect to independent claim 1. That is, 
claim 11 is dependent upon independent claim 1 and thus 
inherently incorporates all of the limitations of independent 
claim 1. Also, the secondary reference (i.e., Langberg et al . ) 
fails to disclose, or even suggest, the deficiencies of the 
primary reference as discussed above with respect to independent 
claim 1. Indeed, the Examiner does not even assert such. Thus, 
the combination of the secondary reference with the primary 
reference also fails to disclose, or even suggest, the 
deficiencies of the primary reference as discussed above with 
respect to independent claim 1. Accordingly, claim 11 should be 
allowable over the combination of the secondary reference with 
the primary reference at least by virtue of its dependency on 
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independent claim 1. Moreover, claim 11 recites additional 

features which are not disclosed, or even suggested, by the 

cited references taken either alone or in combination. 

In view of the foregoing, it is respectfully requested that 

the aforementioned obviousness rejection of claim 11 be 

withdrawn. 

VI. CONCLUSION 

In view of the foregoing, it is respectfully submitted that 
the present application is in condition for allowance, and an 
early indication of the same is courteously solicited. The 
Examiner is respectfully requested to contact the undersigned by 
telephone at the below listed telephone number, in order to 
expedite resolution of any issues and to expedite passage of the 
present application to issue, if any comments, questions, or 
suggestions arise in connection with the present application. 

To the extent necessary, a petition for an extension of 
time under 37 CFR § 1.136 is hereby made. 

Please charge any shortage in fees due in connection with 
the filing of this paper, including extension of time fees, to 
Deposit Account No. 50-0206, and please credit any excess fees 
to the same deposit account. 
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Respectfully submitted, 




Registration No. 37,063 

TEA/DD 

Hunton & Williams LLP 
1900 K Street, N.W. 
Washington, D.C. 20006-1109 
Telephone: (202) 955-1500 
Facsimile: (202) 778-2201 

Date: May 27, 2008 
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